JP6014746B2 - Unauthorized use detection method and unauthorized use detection device - Google Patents

Description

  The present invention relates to a user specifying method in a computer system.

  With the rapid spread of mobile terminals such as smartphones and tablet terminals, employees are increasingly using these terminals for business. However, when a third party misuses the terminal due to loss or theft of the terminal, there is a risk that information leaks due to unauthorized access to the in-house system. Generally, security measures (terminal lock, remote wipe, etc.) on the terminal side are implemented, but it cannot be completely prevented if the lock is not set or theft in the unlocked state. For this reason, countermeasures against unauthorized use are also required on the in-house system side, not on the terminal side.

JP 2006-260454 A JP2011-197802 JP 2009-175984 A

  Patent Document 1 discloses a method of detecting when a user operation differs from a conventional tendency in online banking and authenticating by another means (email or telephone). Examples of specific user operations include the tendency of wrong passwords, input habits (full-width / half-width, presence / absence of numerical commas), and the like. However, a method for detecting by combining a plurality of determination criteria is not disclosed, and there is a problem that the probability of erroneous detection is high. In addition, the determination process is performed only from the information input to the input item and transmitted to the server side. Therefore, it cannot be determined that the page is not an input item, and the detection timing is limited. Further, when unauthorized use is detected, re-authentication is performed by e-mail or telephone, so that there is a problem that the authentication cost is high.

  Patent Document 2 discloses a method for analyzing features and tendencies of website users using feature amounts of operations on a web browser. However, the analysis contents are designed depending on the contents of the website, so it cannot be applied to general websites. It also analyzes the characteristics and trends of Web site users and does not determine whether or not it is unauthorized use.

Patent Document 3 discloses a method of calculating a probability that an access user is the person himself / herself using a Bayesian network constructed from past customary information. The custom information to be used includes time information including access date, access time zone, etc., average keystroke speed of keyboard when entering ID and password, speed between adjacent keystrokes, mouse operation trajectory information, etc. is there. However, a specific probability calculation method using such custom information is not disclosed, and the variation of custom information among users is not taken into account. In the conventional technology described above, a plurality of judgment criteria (features) are used. There is a problem in that the misdetection probability is high because the determination process of unauthorized use is not performed in combination and the variation of the feature amount between users is not considered.

  In view of such circumstances, an object of the present invention is to improve detection accuracy of unauthorized use of a terminal.

  Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.

  A plurality of operation feature values calculated from a user operation log and a weight of a plurality of user operation feature values calculated using a plurality of operation feature values of other users are recorded, and an operation log of the terminal device is recorded. Obtaining a plurality of operation feature amounts from the operation log, and calculating the similarity between the calculated plurality of operation feature amounts and the plurality of recorded user operation feature amounts of the plurality of operation feature amounts of the recorded user. This is an unauthorized use detection method that calculates using a weight and detects unauthorized use of a terminal device.

  According to the present invention, it is possible to improve the detection accuracy of unauthorized use of a terminal.

  Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments.

It is an example of the figure showing the hardware constitutions of a system. It is an example of a figure showing the flow of operation feature-value weight calculation processing. It is an example of an operation log table. It is an example of the operation feature-value table. It is an example of the operation feature-value weight table. It is an example of the flowchart showing the operation feature-value weight table calculation process in an unauthorized use detection function. It is an example of the flowchart showing the use condition determination process in an unauthorized use detection function. It is an example of the figure showing the flow of an unauthorized use determination process. It is an example of a determination threshold value table. It is an example of a determination result table. It is an example of the flowchart showing the unauthorized use determination process in an unauthorized use detection function. It is an example of the figure showing the system configuration | structure in the case of performing unauthorized use detection in a mobile terminal device, and the flow of operation | movement.

  Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings.

  FIG. 1 is a block diagram illustrating a hardware configuration of a computer system to which the present invention is applied according to an embodiment.

  In FIG. 1, a mobile terminal device 110 on which a user performs business, an operation analysis server 130 that analyzes user terminal operations and monitors unauthorized use, and an application program for the user to perform business operate on the network 101. A business Web server 170 is connected.

  The mobile terminal device 110 includes a CPU 111 that performs arithmetic processing, a memory 112 that stores programs and data, a communication interface 113 that communicates with other servers via the network 101, and a position for detecting the position of the mobile terminal. A detection module 114, an acceleration sensor 115 for measuring the acceleration of the mobile terminal, a screen display device 116 for displaying an operation screen, and a touch sensor 117 for detecting a position touched by the user on the screen display device. Prepare. The user operates the web browser 121 by operating the touch sensor 117. The connection between the communication interface 113 and the network 101 may be a wired network or a wireless network.

  A web browser 121 exists as a program in the memory 112 of the mobile terminal device 110. Further, the web browser 121 includes a rendering engine 122 that displays a response from the business web server 170 on a screen, and a script engine 123 that executes an operation recording function 124 and an operation log transmission function 125 included in the response. The operation recording function 124 records an operation performed by the user on the Web browser 121 as an operation log, and the operation log transmission function 125 transmits the recorded operation log to the operation analysis server 130.

  The operation analysis server 130 includes a CPU 131, a memory 132, a communication interface 133, a disk controller 134, and a local disk 135. An operation analysis program 141 exists in the memory 132 of the operation analysis server 130, and the operation analysis program 141 includes an operation record module insertion function 142, a response modification function 143, and an unauthorized use detection function 144. Various functions are realized by the CPU 131 reading and executing various programs recorded in the memory. The local disk 135 also stores an operation log table 145, an operation feature value table 146, an operation feature value weight table 147, a determination threshold value table 148, and a determination result table 149.

  The business Web server 170 includes a CPU 171, a memory 172, a communication interface 173, a disk controller 174, and a local disk 175. A business application program 181 exists in the memory 172 of the operation analysis server 170. Here, the business application program 181 is a program capable of operating e-mail transmission / reception, merchandise inventory management, attendance management, business case management, and the like from a Web browser.

  First, a process for calculating the operation feature amount weight necessary for the unauthorized use determination process will be described with reference to FIGS.

  FIG. 2 is a system configuration diagram showing the flow of processing when calculating the operation feature amount weight.

  The user accesses the business application 181 running on the business web server 170 using the web browser 121 of the mobile terminal device 110. When the Web browser 121 issues a request (S201), the operation recording module 142 of the operation analysis server 130 traps the request, and the operation recording module 142 transmits the same request to the business application 181 of the business Web server 170 (S202). ). The business application 181 transmits a response to the request (S203), and the operation recording module 142 embeds the operation recording function 124 and the operation log transmission function 125 in the received response and transmits them to the Web browser 121 (S205).

  Although the screen of the business application 181 is displayed on the Web browser 121, the operation recording function 124 and the operation log transmission function 125 are simultaneously executed in the script engine 123. When the user performs an operation on the screen (S206), the operation recording function 124 records the operation content (S207), and the operation log transmission function 125 transmits it to the operation analysis server 130 (S208).

  Upon receiving the operation log from the mobile terminal device 110, the unauthorized use detection function 144 on the operation analysis server 130 stores the operation log in the operation log table 145. Further, an operation feature value is calculated from the received operation log and stored in the operation feature value table 146 (S209). Further, a feature weight is calculated from the operation feature table 146 and stored in the operation feature weight table 147 (S210).

  As described above, the operation recording module 142 embeds the operation recording function 124 and the operation log transmission function 125 in the response S205 to the mobile terminal device 110 without changing the mobile terminal device 110 and the business Web server 170. It is possible to automatically operate the operation recording function 124 and the operation log transmission function 125 in the Web browser 121.

  FIG. 3 shows an example of the operation log table 145.

  The operation log table 145 includes an ID 301 for identifying the user, the date and time 302 when the operation was performed, the URL 303 of the Web page where the operation was performed, the type 304 of the event generated by the operation, and the attribute value 305 corresponding to the event type. Is included.

  As an example, when a user displays a Web page, an operation log record having an event type “load” is recorded. When the user displays another Web page or exits the Web browser, the event type “unload” is recorded. In addition, when the user touches the touch panel, an operation log record with the event type “touchstart” is recorded, and when the user releases the touch panel, an operation log record with the event type “touchend” is recorded. At this time, coordinates on the touch panel when the hand is touched or released are recorded in the attribute value.

  Further, when the user scrolls the Web page displayed on the Web browser, the event type “scroll” is recorded together with the scroll movement amount.

  Further, when the user inputs text in the input field in the Web page, the content is recorded as “keypress”.

  When the user presses a button displayed on the Web page or a link to another Web page, “click” is recorded.

  In addition, when the user changes the screen display direction (vertical direction or horizontal direction) of the mobile terminal apparatus 110, the event type “orientation change” is recorded.

  Further, the terminal position information (latitude, longitude, moving speed) acquired from the position detection module 114 is recorded as the event type “geolocation”.

  The acceleration information acquired from the acceleration sensor 115 is recorded as the event type “devicemotion”.

  FIG. 4 shows an example of the operation feature amount table 146.

In the operation feature value table 146, N operation feature values 404 to 406 are recorded for combinations of the URL 401 of the Web page, the ID 402 for identifying the user, and the usage status 403 of the mobile terminal device. Here, the value of the operation feature value V _i of the user X when the usage status is on the desk is described as V _{Xi_D,} and the case where the usage status is handheld is described as V _{Xi_H} . The usage status 403 will be described in detail in the description of FIG.

  The operation feature amount is calculated from acceleration information acquired by the acceleration sensor 115 of the mobile terminal, position information acquired by the position detection module 114, touch panel operation information acquired by the touch sensor 117, and the like.

  Here, the operation feature amount is, for example, as follows. Page browsing time calculated from the time required from “load” to “unload”, touch average time calculated from the average time required from “touchstart” to “touchend”, scroll movement amount, and touch required during scrolling The scroll operation speed calculated from the time, the scroll operation position on the touch panel calculated from the coordinates of “touchstart” and “touchend”, and the Web page display by the touch operation calculated from the coordinates of “touchstart” and “touchend” Operation direction and frequency of enlargement / reduction, character input speed calculated from “keypress”, screen display direction (vertical / horizontal) recorded in “orientation change”, recorded in “devicemotion” And the angle and the vibration amount of the terminal which is calculated from the acceleration.

In addition, the operation feature value table 146 stores an operation feature value average value _{Vi_avg} obtained by averaging the operation feature values for all the users for each Web page.

  FIG. 5 shows an example of the operation feature amount weight table 147.

The operation feature amount weight table 147 includes N operation feature amount weights 504 to 506 for combinations of the URL 501 of the Web page, the ID 502 for identifying the user, and the usage status 503 of the mobile terminal device. Here, the operation feature weight value W _i for the operation feature V _i of the user X is described as W _{Xi_D} .

  FIG. 6 is a flowchart of the feature amount weight calculation process in the unauthorized use detection function 144.

When a user operation log is received from the mobile terminal device 110, the operation log is written into the operation log table 145 (S601). Next, based on the received operation log, the operation feature amount of the user is calculated (S602). Next, the usage status of the user's mobile terminal is determined by the usage status determination process described in FIG. 7 (S603). For the Web page URL, the user, and the usage status, the operation feature value is written to the operation feature value table 146 (S604), and the average value V _{i_avg} in the operation feature value table 146 is calculated again and updated (S604).

  Further, the operation feature amount weight is calculated by Equation 1, and the operation feature amount weight in the use situation determined in S604 of the user is recorded (S606).

  In the calculation of the operation feature amount weight in Equation 1, the weight of the feature amount that is different from the average of all users is increased. As a result, the feature weight is increased with respect to an operation in which the features of each user tend to appear, so that an effect of improving the unauthorized use detection accuracy can be obtained.

  FIG. 7 shows an example of a flowchart of usage status determination processing S603 in the unauthorized usage detection function 144.

  Using the vibration amount stored in the operation feature amount table 146, it is determined whether the vibration amount is a certain value or more (S701). If the vibration amount is greater than a certain value, it is determined whether the vibration period is equal to or less than the certain value (S702). If the vibration period is equal to or less than a certain value, it is determined that the vehicle is “on board” (S703). If the vibration period is greater than or equal to a certain value, it is determined whether the terminal angle has changed (S704), and if there is a change, the terminal is determined to be “hand-held walking” (S705). When there is no change in the terminal angle, the usage status is set to “other unknown” (S706). Even when the vibration amount is equal to or smaller than a certain value in S701, it is determined whether there is a change in the terminal angle as in S704 (S707), and if there is a change, the terminal is determined to be “hand-held still” (S708). ). When there is no change in the terminal angle, the usage status is set to “desktop” (S709).

  In the above description, the determination process is performed based on the terminal angle and the vibration amount. However, the determination may be performed by combining the terminal position information.

  The mobile terminal device has a great tendency to operate when it is placed on a desk and operated with both hands, and when it is held with one hand and operated with the other hand. In addition, the tendency of operation may change depending on the surrounding environment while walking or getting on a train or car. For this reason, as described above, the usage status of the mobile terminal device is determined from the vibration amount and the terminal angle (S604), and the operation feature value weight for each usage status is calculated, so that it is expected to improve the unauthorized usage detection accuracy.

  In the above, the process at the time of calculating operation feature-value weight was demonstrated. Next, the flow of processing when performing unauthorized use detection processing when a user accesses will be described with reference to FIGS.

  FIG. 8 is a system configuration diagram showing the flow of unauthorized use detection processing.

  When the user performs an operation by displaying the screen of the business application 181 on the Web browser 121 (S801), the operation log is transmitted to the operation analysis server 130 by the operation recording function 124 and the operation log transmission function 125 (S802). , S803). Upon receiving the operation log from the mobile terminal device 110, the unauthorized use detection function 144 on the operation analysis server 130 stores the operation log in the operation log table 145. Further, an operation feature value is calculated from the received operation log, and an operation feature value and an operation feature value weight corresponding to the user ID are acquired from the operation feature value table 146 and the operation feature value weight table 147. The similarity between the operation feature amount calculated from the received operation log and the operation feature amount recorded in the operation feature amount table 146 is calculated. At this time, using the operation feature value weight recorded in the operation feature value weight table 147, the similarity of the operation feature value is calculated with a weight. As a result, it is possible to calculate the similarity of the operation feature amount by placing more importance on the feature amount in which the feature of the authorized user is likely to appear, and it is possible to improve the determination accuracy of unauthorized use. A method for calculating the weighted similarity of the feature amount will be described in detail in the description of FIG. The weighted similarity of this feature amount is used as an unauthorized use probability. The unauthorized use determination result is calculated by comparing the calculated unauthorized use accuracy with the determination threshold stored in the determination threshold table 148, and stored in the determination result table 149 (S804).

  Thereafter, when a web page request is made from the user, the flow from S805 to S808 is the same as the flow from S201 to S204 in FIG. 2, but the response modification function 143 refers to the determination result table 149 and The response to the mobile terminal device 110 is modified based on the determination result in (S809).

  In re-authentication when the possibility of unauthorized use is suspected, it is complicated for the user to always re-enter the user ID and password in the mobile terminal. Therefore, in this embodiment, the re-authentication method is switched according to the unauthorized use accuracy. This eliminates the need for complicated authentication using a user ID or password, thus improving usability. Details will be described below.

  FIG. 9 shows an example of the determination threshold value table 148.

  The determination threshold value table 148 includes a response type 901 and a determination threshold value 902 corresponding to each response type. The determination threshold value 902 includes a determination threshold value 903 when the terminal is in the management area and a determination threshold value 904 when the terminal is outside the management area. The determination threshold value 905 in the case of outside the management area further includes a determination threshold value 905 when the user access destination is the website A and a determination threshold value 906 when the user is the website B. Here, the management area is a place where the terminal can be used safely, for example, an office office. In this example, only the determination threshold value 904 in the case of outside the management area is set to be different depending on the website of the access destination. Similarly, the determination threshold value 903 in the management area is also determined for each website. May be set.

It is determined from the location information of the terminal whether the terminal is in the management area. If the terminal is in the management area, if the unauthorized use accuracy is equal to or higher than T _{IN_1} , the determination result is an access rejection, and the unauthorized use accuracy is less than T _{IN_1} T determination results when it is _{IN_2} or become authentication necessity determination result is a re-operation is needed when it is fraud probability is T _{IN_2} less T _{IN_3} above problem determination result if fraud probability is less than T _{IN_3} None. Even if the terminal is outside the management area, similarly it determines using the T _{OUT_1} through T _{OUT_3.} The operation analysis server holds in advance position information corresponding to the inside and outside of the management area in order to determine whether the terminal is within the management area. The determination threshold can be set from the outside by the administrator of the operation analysis server.

Unauthorized use in situations where the terminal is likely to be stolen or lost, such as while moving, by setting the threshold 904 outside the management area (T _{OUT_1 to} T _{OUT_3} ) to be lower than the threshold 903 within the management area (T _{IN_1 to} T _{IN_3} ) It is possible to improve the detection probability. Further, by using a determination threshold according to the access destination website, the determination threshold is tightened for a highly confidential website, and the determination threshold is loosened for a low confidential website. Judgment processing can be performed.

  FIG. 10 shows an example of the determination result table 149.

  The determination result table 149 includes a user ID 1001 and a determination result 1002 corresponding to each user ID.

  When a request from a user is made, the response modification function 143 obtains an unauthorized use determination result corresponding to the user ID of the user from the determination result table 149 and performs a response modification according to the unauthorized use determination result. Then, a response is transmitted to the Web browser 121.

  If the unauthorized use determination result is “access denied”, the response from the user is not transmitted and the access from the user is denied. If the result of the unauthorized use determination is “authentication required”, the user is moved to an authentication Web page based on the user ID and password. If the result of the unauthorized use determination is “re-operation required”, the user is moved to another Web page where a difference in the operation feature amount is likely to appear. Here, as to which Web page the user is moved, the operation feature value sensitivity of each Web page for the user is calculated by Equation 2, and the Web page with the highest operation feature value sensitivity is selected as the destination page.

  If the unauthorized use determination result is “no problem”, the response is transmitted to the Web browser 121 without modification.

  As described above, by switching the re-authentication method according to the unauthorized use accuracy, it is possible to improve usability because it is not necessary to perform a complicated authentication procedure with a user ID or password when the unauthorized use accuracy is not large. It becomes.

  FIG. 11 shows a flowchart of the unauthorized use determination process in the unauthorized use detection function 144.

  When a user operation log is received from the mobile terminal device 110, the operation log is written into the operation log table 145 (S1101). Next, based on the received operation log, the operation feature amount of the user is calculated (S1102). Next, the usage status of the user's mobile terminal is determined by the usage status determination process described in FIG. 7 (S1103). The operation feature amount corresponding to the combination of the Web page URL, the user ID, and the usage status is acquired from the operation feature amount table 146 (S1104), and the unauthorized use probability is calculated from Equation 3 (S1105). Based on the calculated unauthorized use accuracy and determination threshold table 148, unauthorized use determination processing is performed, and the determination result is written in the determination result table (S1106).

  With the above embodiment configuration, it is possible to improve the unauthorized use detection accuracy by the operation feature amount weight calculation determination process for considering the combination of a plurality of operation feature amounts and the variation of the operation feature amounts between users. Become.

  Further, by switching the re-authentication method according to the unauthorized use accuracy, it is not necessary to perform complicated authentication with a user ID or password, so that usability can be improved.

  In this embodiment, a method of performing unauthorized use determination processing on the mobile terminal device 110 side will be described.

  FIG. 12 shows a system configuration and a process flow when the unauthorized use determination process is performed on the mobile terminal apparatus 110 side.

  The user accesses the business application 181 running on the business Web server 170 using the Web browser 121 of the mobile terminal device 110. When the Web browser 121 issues a request (S1201), the operation recording module 142 of the operation analysis server 130 traps the request, and the operation recording module 142 transmits the same request to the business application 181 of the business Web server 170 (S1202). ). The business application 181 transmits a response to the request (S1203), and the operation recording module 142 embeds the operation recording function 124 and the terminal side unauthorized use detection function 150 in the received response, and transmits them to the Web browser 121 (S1205). At this time, information related to the user in the operation feature table 146, the operation feature value weight table 147, and the determination threshold value table 148 of the operation analysis server is transmitted to the terminal side unauthorized use detection function 150 (S1204).

  When the user performs an operation by displaying the screen of the business application 181 on the Web browser 121 (S1206), the operation content is acquired by the operation recording function 124 (S1207).

  The terminal side unauthorized use detection function 150 performs unauthorized use determination processing from the acquired operation content and operation feature amount table 146, operation feature amount weight table 147, and determination threshold value table 148, and stores the result in the determination result table 149. To do. The determination processing method at this time is the same as that shown in FIG.

  The terminal-side unauthorized use detection function 150 makes a page transition request to the Web browser 121 based on the determination processing result (S1209).

  As described above, by performing unauthorized use detection processing in the mobile terminal device 110, it is possible to perform unauthorized use detection processing at any timing, not limited to the timing at which the user accesses the Web page.

  In the first and second embodiments described above, the operation recording function 124, the operation log transmission function 125, and the terminal-side unauthorized use detection function 150 have been described as operating on the Web browser 121. It may be an independent program corresponding to the application.

  Further, the operation analysis program 141 may be operated on the business server 170 so that the operation analysis server 130 is not necessary.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment. Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

DESCRIPTION OF SYMBOLS 110 Mobile terminal device 130 Operation analysis server 170 Business Web server 121 Web browser 141 Operation analysis program 142 Operation recording module insertion function 143 Response modification function 144 Unauthorized use detection function 145 Operation log table 146 Operation feature amount table 147 Operation feature amount weight table 148 Judgment threshold table 149 Judgment result table 181 Business application

Claims (14)

Calculated from one or more types of operation feature quantities calculated from user operation logs, an average of the operation feature quantities of a plurality of users calculated for each type of operation feature quantity, and the user operation feature quantities And the weight of one or more kinds of operation feature values of the user,
Acquire terminal device operation logs,
Calculating the operating characteristic quantity of one or more types from the operation log,
The recording of the operation feature amount the calculated degree of similarity between the operation characteristic of the recorded user for the type of operation feature quantities thus calculated, corresponding to the type of operation feature amount thus calculated It has been calculated using the weight of the operation characteristic of the user, fraud detection method for detecting unauthorized use of the terminal device. An unauthorized use detection method according to claim 1,
An unauthorized use detection method characterized in that the one or more types of operation feature quantities are calculated using at least one of acceleration information, position information of the terminal device, and operation information of a touch panel of the terminal device. An unauthorized use detection method according to claim 1,
The usage status of the terminal device is determined from the operation feature amount,
An unauthorized use detection method, wherein the similarity is calculated using a weight of one or more types of operation feature amounts of the user corresponding to the determined use situation. An unauthorized use detection method according to claim 1,
An unauthorized use detection method, wherein the one or more types of operation feature values and the weight of the one or more types of operation feature values are recorded for each Web page browsed by the user. An unauthorized use detection method according to claim 1,
An unauthorized use detection method, wherein an authentication method is changed according to the similarity. The unauthorized use detection method according to claim 5,
Comparing the similarity with a predetermined threshold;
Depending on the comparison result, access to a web page is denied, a web page for re-authentication is displayed on the terminal device, or a web page for the user of the terminal device to perform a re-operation is displayed on the terminal device Or any one of them is displayed. An unauthorized use detection method according to claim 6,
An unauthorized use detection method, wherein the predetermined threshold value is changed in accordance with an access destination website or position information of the terminal device. Calculated from one or more types of operation feature quantities calculated from user operation logs, an average of the operation feature quantities of a plurality of users calculated for each type of operation feature quantity, and the user operation feature quantities A recording unit that records the weights of one or more types of operation feature quantities of the user;
An operation log acquisition unit for acquiring an operation log of the terminal device;
An operating characteristic amount calculating unit for calculating the operating characteristic quantity of one or more types from the operation log,
The recording of the operation feature amount the calculated degree of similarity between the operation characteristic of the recorded user for the type of operation feature quantities thus calculated, corresponding to the type of operation feature amount thus calculated has been calculated using the weight of the operation characteristic of the user, fraud detection apparatus characterized by having a fraud detector for detecting unauthorized use of the terminal device. The unauthorized use detection device according to claim 8,
The operation feature amount calculation unit calculates the one or more types of operation feature amounts using at least one of acceleration information, position information, or operation information of the touch panel of the terminal device. Characterized unauthorized use detection device. The unauthorized use detection device according to claim 8,
A usage status determination unit that determines the usage status of the terminal device from the operation feature amount;
The unauthorized use detection device, wherein the unauthorized use detection unit calculates the similarity using weights of one or more types of operation feature amounts of the user corresponding to the determined use situation. The unauthorized use detection device according to claim 8,
The recording unit records the weight of the one or more types of operation feature amounts and the one or more types of operation feature amounts for each Web page browsed by the user. . The unauthorized use detection device according to claim 8,
An unauthorized use detection apparatus, wherein an authentication method is changed according to the similarity. An unauthorized use detection device according to claim 12,
Comparing the similarity with a predetermined threshold;
Depending on the comparison result, access to a web page is denied, a web page for re-authentication is displayed on the terminal device, or a web page for the user of the terminal device to perform a re-operation is displayed on the terminal device Or any one of them is displayed. An unauthorized use detection device according to claim 13,
An unauthorized use detection apparatus, wherein the predetermined threshold value is changed according to a Web site to be accessed or position information of the terminal device.

Images